git: 468babfa680f - releng/14.5 - bhyve: Improve HDA stream descriptor validation

The branch releng/14.5 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=468babfa680f55c576efdf81d90e7622b08c1ff1

commit 468babfa680f55c576efdf81d90e7622b08c1ff1
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-10-13 19:58:36 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-10-13 20:23:06 +0000

    bhyve: Improve HDA stream descriptor validation
    
    The length of each block in the stream must be non-zero.  This is
    assumed in hda_transfer(), otherwise an out-of-bounds read or write is
    possible.
    
    Use atomic loads to access stream descriptor fields, since they are
    guest-controlled.  Make sure that the descriptor array is suitably
    aligned so that we can drop the __packed annotation from the structure
    definition; per section 3.3.42 of the HDA spec the BDL pointer is
    supposed to be 128-byte aligned, in fact.
    
    Approved by:    so
    Security:       FreeBSD-SA-26:72.bhyve
    Security:       CVE-2026-101310
    Reported by:    Brian Delgado from Intel using Anthropic Opus 4.8
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D60678
---
 usr.sbin/bhyve/pci_hda.c | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/usr.sbin/bhyve/pci_hda.c b/usr.sbin/bhyve/pci_hda.c
index 58481af71a4c..3a29ee386f8f 100644
--- a/usr.sbin/bhyve/pci_hda.c
+++ b/usr.sbin/bhyve/pci_hda.c
@@ -29,6 +29,9 @@
 
 #include <sys/cdefs.h>
 #include <sys/param.h>
+
+#include <machine/atomic.h>
+
 #include <time.h>
 
 #include "pci_hda.h"
@@ -82,7 +85,7 @@ struct hda_bdle {
 	uint32_t addrh;
 	uint32_t len;
 	uint32_t ioc;
-} __packed;
+};
 
 struct hda_bdle_desc {
 	void *addr;
@@ -625,8 +628,9 @@ hda_stream_start(struct hda_softc *sc, uint8_t stream_ind)
 	bdl_paddr = bdpl | (bdpu << 32);
 	bdl_vaddr = hda_dma_get_vaddr(sc, bdl_paddr,
 	    HDA_BDL_ENTRY_LEN * bdl_cnt);
-	if (!bdl_vaddr) {
-		DPRINTF("Fail to get the guest virtual address");
+	if (bdl_vaddr == NULL ||
+	    (uintptr_t)bdl_vaddr % HDA_DMA_ACCESS_LEN != 0) {
+		DPRINTF("Invalid guest virtual address %p", bdl_vaddr);
 		return (-1);
 	}
 
@@ -637,11 +641,14 @@ hda_stream_start(struct hda_softc *sc, uint8_t stream_ind)
 
 	bdle = (struct hda_bdle *)bdl_vaddr;
 	for (size_t i = 0; i < bdl_cnt; i++, bdle++) {
-		bdle_sz = bdle->len;
-		assert(!(bdle_sz % HDA_DMA_ACCESS_LEN));
+		bdle_sz = atomic_load_32(&bdle->len);
+		if (bdle_sz % HDA_DMA_ACCESS_LEN != 0 || bdle_sz == 0) {
+			DPRINTF("Invalid BDLE length: 0x%x", bdle_sz);
+			return (-1);
+		}
 
-		bdle_addrl = bdle->addrl;
-		bdle_addrh = bdle->addrh;
+		bdle_addrl = atomic_load_32(&bdle->addrl);
+		bdle_addrh = atomic_load_32(&bdle->addrh);
 
 		bdle_paddr = bdle_addrl | (bdle_addrh << 32);
 		bdle_vaddr = hda_dma_get_vaddr(sc, bdle_paddr, bdle_sz);
@@ -653,7 +660,7 @@ hda_stream_start(struct hda_softc *sc, uint8_t stream_ind)
 		bdle_desc = &st->bdl[i];
 		bdle_desc->addr = bdle_vaddr;
 		bdle_desc->len = bdle_sz;
-		bdle_desc->ioc = bdle->ioc;
+		bdle_desc->ioc = atomic_load_32(&bdle->ioc);
 
 		DPRINTF("bdle: 0x%zx bdle_sz: 0x%x", i, bdle_sz);
 	}